Security

Everything on this page describes what the application actually implements. Where we have not done something, we say so rather than leaving it out.

Where we are

TextSetu is early-access software built by a small, unincorporated team. We do not hold SOC 2, ISO 27001 or any other third-party certification, and we are not going to imply otherwise. What follows is what we do and do not do, so you can make your own judgement.

Protecting data

• Passwords are hashed with Argon2id, the current recommended password-hashing function. We never store them in a recoverable form.
• AI provider keys you supply are encrypted at rest with AES-256-GCM, an authenticated cipher, so tampering with the stored value is detected. They are never displayed back to you in full.
• Sessions use signed JSON Web Tokens, valid for 7 days by default. The server sets no cookies.
• Transport security. HTTPS throughout, with HSTS enabled in production.
• HTTP hardening. A Content-Security-Policy, frameguard set to sameorigin to prevent clickjacking, and a restrictive Permissions-Policy.
• Rate limiting is applied globally to the API.
• Access control. Multi-role permissions scoped to organisations, projects and teams, so people see only what their role allows.
• Audit logging. Every edit, approval and import is recorded with author and timestamp, and is visible to you in the product.

AI and your data

• Source strings and assembled context are sent to the AI provider you select. Nothing is sent to a provider you have not enabled.
• We do not train models on your content.
• Bringing your own provider key keeps the request inside your own provider account. If you have strict data requirements, this is the option we recommend.
• See Sub-processors for the full list and locations.

What we have not done yet

Stating this plainly is more useful to you than a padded list:

• No third-party penetration test.
• No formal compliance certification.
• No contractual uptime or support SLA.
• No self-service account deletion: deletion requests are handled manually.
• No automated data retention or purge schedules.
• No customer-managed encryption keys, enforced-SSO policy, or IP allowlisting.
• No consent gating in front of product analytics. See Cookies and Local Storage.

Reporting a vulnerability

If you believe you have found a security issue, email hello@textsetu.com with enough detail to reproduce it. We will acknowledge within 5 working days.

Please give us a reasonable chance to fix the issue before disclosing it publicly. Do not access, modify or delete data belonging to anyone else, do not degrade the service, and do not run automated scans against production without asking first. If you follow that, we will not pursue action against you for good-faith research.

We do not currently run a paid bug bounty.

Incident response

If we become aware of a breach affecting personal data we will investigate, contain it, and notify affected customers and the relevant supervisory authority as required: for GDPR, without undue delay and within 72 hours of becoming aware where the breach is notifiable.